Adware.Panda.222

Техническая информация

Вредоносные функции:

Выполняет код следующих детектируемых угроз:

Adware.Panda.5.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) hk.wagbr####.non####.####.com:80
TCP(HTTP/1.1) 2####.151.212.66:80
TCP(HTTP/1.1) 2####.151.212.169:80
TCP(HTTP/1.1) req####.a####.cn:80
TCP(HTTP/1.1) 1####.205.163.87:80
TCP(HTTP/1.1) me####.t####.com:80
TCP(HTTP/1.1) 2####.107.1.1:80
TCP(HTTP/1.1) me####.t####.com.####.cn:80
TCP(HTTP/1.1) cd####.md####.cn.####.cn:80
TCP(HTTP/1.1) ada####.m.ta####.com:80
TCP(TLS/1.0) msg.umengc####.com:443
TCP openj####.m.ta####.com:80
TCP 1####.205.160.76:443

Запросы DNS:

a####.u####.com
ad####.m.ta####.com
ada####.m.ta####.com
ag####.m.ta####.com
cd####.md####.cn
me####.t####.com
me####.t####.com
msg.umengc####.com
req####.a####.cn
umengj####.m.ta####.com
y####.al####.com

Запросы HTTP GET:

cd####.md####.cn.####.cn/resource/gis/45
me####.t####.com.####.cn///getDirectory/xml/466546/466546.zip
me####.t####.com.####.cn//0/5/9/0/0590fd13887b4f0ebda467029ae899b1_190_1...
me####.t####.com.####.cn//1/a/a/f/1aafde16aaed4153ae6c449628031ff9_190_1...
me####.t####.com.####.cn//1/d/e/6/1de6d721b0cc414fbddec472f5df5da8_190_1...
me####.t####.com.####.cn//2/3/9/1/2391b91919c74078b8f60bb2c8eeedc3_190_1...
me####.t####.com.####.cn//2/4/1/6/241652de08bb473395e1b5e84e30c479_190_1...
me####.t####.com.####.cn//2/b/0/d/2b0d5a8707d247f1b8229df10249074f_190_1...
me####.t####.com.####.cn//2017/05/02/b/6/5/d/b65ddedbf5ce41d98e43d1557f6...
me####.t####.com.####.cn//2018/01/09/d/3/8/6/d386f4d24b954de18ff2bef74b1...
me####.t####.com.####.cn//2018/07/31/0/d/f/4/0df40c8dce2f4d2bbcea6e87be2...
me####.t####.com.####.cn//3/a/3/8/3a38956758a149e9ab6105e5770ecc6b_190_1...
me####.t####.com.####.cn//4/f/4/c/4f4c8ca1181d418f91d87f624fb1de72_190_1...
me####.t####.com.####.cn//5/3/9/8/5398d0813fd14e81a03f54ae575c568d_190_1...
me####.t####.com.####.cn//6/1/3/9/61396785ec2e464381367305ec2e79db_190_1...
me####.t####.com.####.cn//6/9/4/8/694812aa7d414299b97de7cf8aeb2dcd_190_1...
me####.t####.com.####.cn//7/1/0/8/7108b0862fab43c99858d1ac49a38da3_190_1...
me####.t####.com.####.cn//7/1/b/8/71b8f48c743a464a86610a672faab417_190_1...
me####.t####.com.####.cn//7/5/e/f/75efbcf2d7ab48f0879bcd1c91640df7_190_1...
me####.t####.com.####.cn//8/8/0/0/8800d2a2bb10430b82509325e9f009da_190_1...
me####.t####.com.####.cn//9/9/0/c/990c174e8495416b81fe66bdf7c66814_190_1...
me####.t####.com.####.cn//a/7/2/a/a72a6df2227042288d1e656ddc82a956_190_1...
me####.t####.com.####.cn//b/1/b/6/b1b6109251a1429fb60e7ea22713ecab_190_1...
me####.t####.com.####.cn//b/7/4/b/b74bd9741aca4744bfd895ae90a20636_190_1...
me####.t####.com.####.cn//c/8/c/7/c8c7fe5211ee4a1db02c125d8015b4f8_190_1...
me####.t####.com.####.cn//c/d/b/5/cdb54bd6739b459fbd26957136cfe6c2_190_1...
me####.t####.com.####.cn//d/3/8/b/d38b7bfe426e4a2d9474b55ed8c3f2a5_190_1...
me####.t####.com.####.cn//d/d/f/f/ddffcaea831442f7a2f2e95684b0c1a9_190_1...
me####.t####.com.####.cn//e/1/a/e/e1ae7a23d874411ca92de18c1eb4cbfb_190_1...
me####.t####.com.####.cn//e/6/e/c/e6ec4504c9b64e3ca89b4d5fc48cdc03_190_1...
me####.t####.com.####.cn//e/a/b/4/eab4af65349948b4accd8de53650d1ca_190_1...
me####.t####.com.####.cn//f/c/1/e/fc1e9101fca64996adae7d0a3c23bb21_190_1...
me####.t####.com.####.cn/2017/09/20/0/2/b/e/02be2062b2ad4c279a53165f30a7...
me####.t####.com.####.cn/2017/09/20/6/1/d/b/61db7c68f3664c19ac93566b4680...
me####.t####.com.####.cn/2017/09/28/0/6/6/6/0666b2a68bdd442e9c9e4557bdd9...
me####.t####.com.####.cn/2017/11/10/c/1/7/4/c17478f79fd942d3aafa753b5fb6...
me####.t####.com.####.cn/2017/11/10/d/1/e/e/d1eec2dc423442e8ad5c9a5eff3a...
me####.t####.com.####.cn/2018/02/05/7/4/1/c/741cb8cbc19d461590080c11b0fe...
me####.t####.com.####.cn/2018/11/15/0/6/6/2/0662cfa029ff418fb0a7b79b9784...
me####.t####.com//0/b/c/8/0bc8492ae17c4d018899c6a6abafe94b_190_138.jpg
me####.t####.com//2015/12/17/a/e/3/9/ae39ffa86bba405493ddd004460427ad_19...
me####.t####.com//2016/04/11/1/c/b/f/1cbf3804166c4750b49c0442e4999c7a_19...
me####.t####.com//2016/07/11/17/13/19415_06462d65441a4eef9e37a9f96831c6e...
me####.t####.com//2016/08/29/f/f/6/0/ff60c8e4667d4fe49dde8d68eb807ab1_19...
me####.t####.com//2016/11/10/c/e/8/d/ce8d4e14b702490db1deb6f4dcd9bfdf_19...
me####.t####.com//2017/04/24/3/2/7/8/32786991463845b0b77783bd4d4c0dfa_19...
me####.t####.com//2017/05/09/d/2/7/b/d27bbb9eb85b48d69f71862b0760fb38_19...
me####.t####.com//3/2/3/4/323470361d55413ba6bd8c8e5ed28a65_190_138.jpg
me####.t####.com//4/0/6/2/40620d7e72bb45e1ab502f7e6b72603f_190_138.jpg
me####.t####.com//4/e/a/c/4eaca6d1009161091ff3cd7bd2a90003_190_138.jpg
me####.t####.com//6/c/7/4/6c748d3a213b43dab2181634ff2dbb75_190_138.jpg
me####.t####.com//7/9/a/b/79abcb9b044344b69a74f2b6733572cb_190_138.jpg
me####.t####.com//7/9/d/0/79d040896db9416a8871c759ec954b77_190_138.jpg
me####.t####.com//7/c/a/3/7ca3671fbebe429a9d41179fdd41b972_190_138.jpg
me####.t####.com//7/e/5/e/7e5ebb171d8f47b59d1e0ad0c70c24d1_190_138.jpg
me####.t####.com//8/e/f/c/8efced95c25d4afea77e0c5677b18f03_190_138.jpg
me####.t####.com//9/4/9/3/9493a88056b04301a296f0f8b1dc74ac_190_138.jpg
me####.t####.com//a/2/a/c/a2ac53a260984d5394af0c2f7290a0a5_190_138.jpg
me####.t####.com//b/c/7/e/bc7eb38e7e0c4db3ae9198e29edff38a_190_138.jpg
me####.t####.com//c/2/0/9/c2097aef28c848ecbf11db423629339b_190_138.jpg
me####.t####.com//d/0/e/4/d0e4d86bfec14da1868482f583bd326d_190_138.jpg
me####.t####.com//d/6/6/c/d66c4d3268de42a5822abae97b03ce35_190_138.jpg
me####.t####.com//d/8/c/a/d8ca82b6a4724fab9827c0d866ad3323_190_138.jpg
me####.t####.com//d/9/4/c/d94c43dbb85b4f628511f23bea92d058_190_138.jpg
me####.t####.com//e/0/d/7/e0d7554567ee43499c7e8163e1b0833b_190_138.jpg
me####.t####.com//f/4/8/f/f48f762d0cf84f97a9306fb7e07b6044_190_138.jpg
me####.t####.com//f/9/9/7/f997debb88214ce18212c4cc9b9981e4_190_138.jpg
me####.t####.com//f/a/e/9/fae96dd075e84c6ba18987a972b54fb3_190_138.jpg
me####.t####.com//f/f/4/f/ff4fac84ea6f4b12bf421493a0be7a56_190_138.jpg
me####.t####.com/android_dubbo_static//public/assets/images/v3.80/loginH...
me####.t####.com/android_dubbo_static/public//prod/css/boyBookStore421-0...
me####.t####.com/android_dubbo_static/public//prod/css/girlWrong-85953ba...
me####.t####.com/android_dubbo_static/public//prod/images/v3.80/boy/pian...
me####.t####.com/android_dubbo_static/public//prod/js/lib/zepto-f8713262...
me####.t####.com/android_dubbo_static/public//prod/js/page/v380/boyStore...
req####.a####.cn/pservers/loadgis?token=####

Запросы HTTP POST:

a####.u####.com/app_logs
ada####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=###...
hk.wagbr####.non####.####.com/saveWb.json

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.imprint
/data/data/####/0a231bd8575dcf72.txt
/data/data/####/1d77ea041509fe06.lock
/data/data/####/21c22f492aba3de8.lock
/data/data/####/930a31b34bd52c08.lock
/data/data/####/ACCS_BIND.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/APP_FLAG.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DIRECTORY_UPDATE.xml
/data/data/####/DaemonServer
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/NDy.zip
/data/data/####/SETTING.xml
/data/data/####/SGMANAGER_DATA2.tmp
/data/data/####/TADU_TASK.xml
/data/data/####/USERINFO.xml
/data/data/####/UTCommon.xml
/data/data/####/_UserInfoLayout_USER_CONF
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/ap.Lock
/data/data/####/com.tadu.xaq.zip
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/exchangeIdentity.json
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/index
/data/data/####/libsgmainso-5.1.81.so.tmp
/data/data/####/lock.lock
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/mobclick_agent_cached_com.tadu.xaq1123
/data/data/####/multidex.version.xml
/data/data/####/sp.lock
/data/data/####/tadu
/data/data/####/tadu-journal
/data/data/####/tadu-shm (deleted)
/data/data/####/tadu-wal
/data/data/####/td92849036_UserInfoLayout_USER_CONF
/data/data/####/td92849036_UserInfoLayout_USER_INFO
/data/data/####/tk
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_general_config.xml.bak
/data/data/####/umeng_it.cache
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal (deleted)
/data/media/####/.nomedia
/data/media/####/00fb822cbe05f3c9daaa9d52229e671c
/data/media/####/043e3783cf9e21e69dfe487680d6b86b
/data/media/####/05eb5b085f642ecdd91f0937c9d4cf01
/data/media/####/0797eed672c26dce1c75afacb19a29b8
/data/media/####/088763005fb9bcdf9743fa4686620695
/data/media/####/08c6bcccfb68ea3ffd7df1c3d9bca25b
/data/media/####/09ab1298b9b510806208807ba1f506ba
/data/media/####/0a2b0a5e404ec0efe82d89b5eeca62e5
/data/media/####/10deabcff38870f0f9549a95cbe51a13
/data/media/####/140a63c1e6c9449e9d310575d5c12741_248_180.jpg
/data/media/####/1508c352f41307a0cdf0147350f2b5fb
/data/media/####/1550059284459.tar
/data/media/####/1550059284459.tar.gz
/data/media/####/16e1bf0c9102c2df0192be3e73dde32d
/data/media/####/1daaedd2de8f23f1ca830fcdd1f8e4b0
/data/media/####/1dd848bb317e694dd3175dd3277629f7
/data/media/####/2
/data/media/####/20190213_356507059351895
/data/media/####/2487fa3d0d8f5861b36957095660f47e
/data/media/####/254f40a42461f91e451001fb055f60df
/data/media/####/2569363530818ae52603a006ef8b6154
/data/media/####/2a17e792fa194318d5eb55edb7eb6981
/data/media/####/2a9ae100339d2cc0a29b73da11881d14
/data/media/####/2adfc8d996667a974975a068b03d3310
/data/media/####/3
/data/media/####/3614de514681b74251d0c1a7e8942cd6
/data/media/####/38f4e11dee9b8609b92090d7e9431dc0
/data/media/####/3aab3fe3679485483be6537bcb3fd853
/data/media/####/3adadafa76f9532c6e65cc416c7d10c1
/data/media/####/3bfc8d99721587a50b0968de8def21a6
/data/media/####/425940_1.TDZ
/data/media/####/425940_10.TDZ
/data/media/####/425940_2.TDZ
/data/media/####/425940_3.TDZ
/data/media/####/425940_4.TDZ
/data/media/####/425940_5.TDZ
/data/media/####/425940_6.TDZ
/data/media/####/425940_7.TDZ
/data/media/####/425940_8.TDZ
/data/media/####/425940_9.TDZ
/data/media/####/427082_1.TDZ
/data/media/####/427082_10.TDZ
/data/media/####/427082_2.TDZ
/data/media/####/427082_3.TDZ
/data/media/####/427082_4.TDZ
/data/media/####/427082_5.TDZ
/data/media/####/427082_6.TDZ
/data/media/####/427082_7.TDZ
/data/media/####/427082_8.TDZ
/data/media/####/427082_9.TDZ
/data/media/####/42b23f80ce21452c4a8103c66500789e
/data/media/####/466546_1.TDZ
/data/media/####/466546_10.TDZ
/data/media/####/466546_2.TDZ
/data/media/####/466546_3.TDZ
/data/media/####/466546_4.TDZ
/data/media/####/466546_5.TDZ
/data/media/####/466546_6.TDZ
/data/media/####/466546_7.TDZ
/data/media/####/466546_8.TDZ
/data/media/####/466546_9.TDZ
/data/media/####/46ce611b56631a36cf55d5abf95d5adf
/data/media/####/486f26010c932b74fc15bb9727e387e9
/data/media/####/54e1081bb6c6fd9afec4cd5b872d092a
/data/media/####/550bd2e48493291f5e938b431134a01d
/data/media/####/57458efddaef6b8645b6c7a2e564f02a
/data/media/####/5a99d586635364c4eec6031a865e5774
/data/media/####/5e964264f3874a6d1f040cd061a850e6
/data/media/####/5f6b5585465d4d528bdf71583d4c071d
/data/media/####/60396fbaf918a006f282028e9b7d7fdb
/data/media/####/6164efbc255aa96a1238e5b2c830f9e0
/data/media/####/62cc8e622b2de7c00d7ab53d3028ef78
/data/media/####/6c709c11d2d46a7b
/data/media/####/7005bbe96faf2a75fbbd0c736791fcc0
/data/media/####/7484ef76f5323f1a4d3192052ff68643
/data/media/####/7a10890c7fce3a6b0729ec119e45cc37
/data/media/####/7d9a8402aad84e1fa837dc403a2582e9_248_180.jpg
/data/media/####/81d1dfd749d7b58a7157a5077c334944
/data/media/####/83dd533c85022c65d71cd64aac12ff09
/data/media/####/8e26aee70dc98f171a44598982f08df1
/data/media/####/8ec0977648991f52b2b1ae2e9ae2f095
/data/media/####/8fcb8bd7ff1172004cb60144289d2729
/data/media/####/9033ec76573eb87b046779fffe4a717b
/data/media/####/9be7d7cabc83cf51a4c162d7db654e7d
/data/media/####/9e859dd1ee4f6a9639dd25d90a7cfa94
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/ContextData.xml.bak (deleted)
/data/media/####/a2ef79aafb41adcedfb4354894f77362
/data/media/####/a98de15ac29925bdf86ac9efd91c1c5c
/data/media/####/accs_election
/data/media/####/b22da296f81eb455e6c3a31ca138bda2
/data/media/####/b4dcd1b2053840ec97edeb1974fe6b71
/data/media/####/bcbb953de7ff41899679d6a04630e54e_248_180.jpg
/data/media/####/bd52486fe5a136841f60b0957ce20079
/data/media/####/bd7ef2ea1aa162c4fc3859c1ed1acb49
/data/media/####/bdbbf357deb7336d56c44a5dbfa69a5a
/data/media/####/be4f5c6347d276bde93b15dff925f470
/data/media/####/build_in_res.zip
/data/media/####/c1482e8746b172abdcb5206008b09195
/data/media/####/c40ac4c05b71ed477c5fe01373b5b7a7
/data/media/####/cac11360473fd66d93f93518cb01fa3a
/data/media/####/ce6ddde555dc091db609cc135bc0bbe4
/data/media/####/d80cf1e8d1a2678d0dda7780c05a37a5
/data/media/####/db55947a3b174418930ea29728912db8
/data/media/####/dd7893586a493dc3
/data/media/####/e10e67366bf43f1288626ffcd4df5e92
/data/media/####/e1d4e710c59cf90841321115283df3d5
/data/media/####/e2ce61d3138f064d1be72f0b4cd4af3d
/data/media/####/e321dc8289c8fed6fd343b62f16fafd8
/data/media/####/e3beac7eaded76cdf9feb8a068a069de
/data/media/####/e6a6d07b96fcef59c8c5bdabe0ac2c8b
/data/media/####/e6d994d4772e891841aa425504fe00a3
/data/media/####/ee6d653b551e6c53c2fc774b582acb15
/data/media/####/hid.dat
/data/media/####/journal.tmp
/data/media/####/log
/data/media/####/logCache
/data/media/####/register.base
/data/media/####/tab_0.html
/data/media/####/tab_1.html
/data/media/####/tab_2.html
/data/media/####/tab_3.html
/data/media/####/tab_4.html

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /proc/cpuinfo
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:585b8dbd3eae254d19000fe2","utdid":"XGQHEPnZcjsDAGdzx1F9GB4u","sdkVersion":"212"} -I agoodm.m.taobao.com -O 80 -T -Z
chmod 500 <Package Folder>/files/DaemonServer
sh

Загружает динамические библиотеки:

sgmainso-5.1
tnet-3.1
ut_c_api

Использует следующие алгоритмы для шифрования данных:

AES
AES-CBC-PKCS5Padding
DES-ECB-PKCS5Padding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
DES-ECB-PKCS5Padding

Получает информацию о сети.

Получает информацию о телефоне (номер, IMEI и т. д.).

Получает информацию о настроках APN.

Получает информацию об установленных приложениях.

Получает информацию о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней